A vulnerability in GitLab Enterprise Edition versions from 17.8 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 could allow an authenticated attacker to leak sensitive information from confidential issues by injecting hidden prompts into merge request comments. The issue has been remediated in the specified fixed versions.